Duty to refer to the DBS

The rule: section 35 of the Safeguarding Vulnerable Groups Act 2006

Section 35 of the Safeguarding Vulnerable Groups Act 2006 requires a regulated activity provider to give the Disclosure and Barring Service (DBS) the prescribed information it holds about a person when it withdraws permission for them to engage in regulated activity, or “would or might have done so if P had not otherwise ceased to engage in the activity”, for one of three reasons. The provider must think that:

• automatic barring criteria apply: paragraph 1, 2, 7 or 8 of Schedule 3 to the Act, in KCSIE's words, the person has “been cautioned or convicted of a relevant (automatic barring either with or without the right to make representations) offence”;
• the person has engaged in relevant conduct within paragraph 4 (children) or 10 (vulnerable adults) of Schedule 3, which includes “conduct which endangers a child or is likely to endanger a child” and the equivalent for a vulnerable adult; or
• the harm test is satisfied. Section 35(4): “The harm test is that P may– (a) harm a child or vulnerable adult, (b) cause a child or vulnerable adult to be harmed, (c) put a child or vulnerable adult at risk of harm, (d) attempt to harm a child or vulnerable adult, or (e) incite another to harm a child or vulnerable adult.”

The test is the provider's own view, formed by investigating. DBS's leaflet The legal duty to refer to DBS sets the threshold: “To satisfy the harm test there needs to be credible evidence of a risk of harm to vulnerable groups, including children.” A barring referral is not a bar. DBS considers what it is sent and decides whether the person should be barred from engaging in regulated activity with children or vulnerable adults.

Failing to refer is a crime. Under section 38 of the Safeguarding Vulnerable Groups Act 2006, a person who is required to provide information and “fails, without reasonable excuse” to do so commits an offence punishable by a fine not exceeding level 5 on the standard scale. In England and Wales that has been an unlimited fine for offences committed on or after 12 March 2015, under section 85 of the Legal Aid, Sentencing and Punishment of Offenders Act 2012, now applied through section 122(3) of the Sentencing Act 2020. DBS's page still says “a fine up to £5,000”, the level 5 maximum before that change.

Sections 35 to 38 extend to England and Wales. Northern Ireland has a parallel duty to refer to DBS in Article 37 of the Safeguarding Vulnerable Groups (Northern Ireland) Order 2007, though the unlimited fine does not apply to the Northern Ireland offence. Scotland has its own scheme: under section 3 of the Protection of Vulnerable Groups (Scotland) Act 2007, an organisation that dismisses someone from a regulated role, or transfers them out of it, on the referral ground “must give Ministers any prescribed information which it holds”, through Disclosure Scotland.

Who must refer, and who is covered

DBS's guidance Making barring referrals to DBS places the duty on “employers or volunteer managers of people working in regulated activity”, and says it “doesn't apply to family or personal arrangements, parents or members of the public”. Each sector's statutory guidance restates it:

• Schools and colleges. Paragraph 428 of Keeping children safe in education 2026 (KCSIE): “There is a legal requirement for schools and colleges to make a referral to the DBS where they remove an individual from regulated activity (or would have removed an individual had they not left)” and they believe one of the three section 35 reasons applies. Paragraph 429: the duty “applies equally to paid staff and volunteers where they were engaged in regulated activity”.
• Early years. Paragraph 3.19 of the EYFS statutory framework for group and school-based providers: “Providers are required to make a referral to the Disclosure and Barring Service if a member of staff is dismissed (or would have been, had they not left the setting first) because they have harmed a child or put a child at risk of harm.” Paragraph 3.20 of the childminders' framework says the same of an assistant.
• Adult social care. Paragraph 14.127 of the Care and support statutory guidance: an organisation that removes an individual “(paid worker or unpaid volunteer)” from work with an adult with care and support needs because they pose a risk of harm “must make a referral to the Disclosure and Barring Service”.
• Charities, clubs and faith groups. The Act applies directly to any organisation that employs or manages people, paid or unpaid, in regulated activity with children or vulnerable adults.

Agencies have a duty of their own. Section 36 of the Act requires a personnel supplier, such as an employment agency, to refer a person it supplied when it knows they have left regulated activity in the section 35 circumstances, and paragraph 14.75 of the care guidance says that where an agency provided the person, “the legal duty sits with that agency”. Section 36 does not on its face lift the duty from a hiring organisation that is itself the regulated activity provider, so a school or care home that removes an agency worker should not assume the agency's referral covers it.

More people have been in regulated activity with children since 1 September 2026. Section 139 of the Crime and Policing Act 2026, commenced by SI 2026/939, removed the provisions of Schedule 4 to the Safeguarding Vulnerable Groups Act 2006 that took supervised roles out of regulated activity with children. Teaching, training, instructing, caring for or supervising children frequently, on more than 3 days in a 30-day period or overnight is now regulated activity whether or not the person is supervised, paid or unpaid, in England and Wales. A supervised volunteer coach at a sports club or a regular helper at a youth charity may now be in regulated activity, and so within the duty to refer. The DfE removed its older advice on the scope of regulated activity on 1 September 2026 “pending an update”, so work from Schedule 4 and KCSIE 2026, not a saved copy.

When the duty is triggered, and when to refer

Removal from regulated activity includes dismissal, redeployment to work that is not regulated activity and, in DBS's leaflet, redundancy. DBS's guidance adds situations where “the person was re-deployed, resigned, retired, or left. For example, a teacher resigns when an allegation of harm to a student is first made.” A resignation, a retirement or a volunteer who stops coming does not end the duty.

Investigate first. DBS's leaflet says organisations “first need to investigate, gather enough evidence, and conclude their investigation to establish they have met the conditions to make a referral”, and its guidance adds: “You should complete your investigations and disciplinary processes (even if the person has left your employment).” For schools, the allegations against staff guide covers the KCSIE process that comes first.

Suspension. DBS says “The duty to make a referral may not be triggered by temporary suspension, it depends if you have sufficient information to meet the referral duty criteria”, and its leaflet suggests seeking advice from the DBS Regional Outreach Team before referring during a suspension pending investigation. KCSIE paragraph 431, by contrast, says referrals “should be made as soon as possible when an individual is removed from regulated activity” and lists suspension among its examples. The statute reconciles them: the duty arises when permission is withdrawn because the provider thinks a section 35 reason applies. A neutral suspension while the facts are established is not usually that; one imposed because the organisation already believes the harm test is met may be.

No statute sets a deadline in days, and a late referral is still owed.

Telling someone else is not referring. DBS says the duty “applies even when a report has been made to another body such as a local authority safeguarding team”, and “irrespective of whether another body has made a referral to the DBS in relation to the same person”. The local authority designated officer (LADO), Ofsted, the Care Quality Commission, the police or a professional regulator may each need to hear about the same events; the barring referral is a separate step. A teacher's referral to the Teaching Regulation Agency is a separate decision again.

A settlement agreement cannot remove the duty. KCSIE paragraph 497 says schools and colleges “should not let it prevent the employer from: fulfilling their legal duty to refer cases to the DBS where the referral criteria are met”, adding: “Non-compliance of this duty is a criminal offence”.

What information to give DBS in a referral

The information is prescribed in the Schedule to the Safeguarding Vulnerable Groups Act 2006 (Prescribed Information) Regulations 2008. They were made for the Independent Barring Board, whose functions passed to DBS, and legislation.gov.uk holds them only as made, so DBS's own guidance is the current word. The Schedule covers:

1. the person's identifying details, the regulated activity they did and any professional register entry;
2. their employment: application and letter of appointment, job description, qualifications, employment history, disciplinary record, training, and the reasons permission was or would have been withdrawn;
3. their conduct: “a summary of the conduct including details of the setting and location in which such conduct occurred”, any harm or risk of harm to a child or vulnerable adult, and any admission or explanation;
4. why the provider thinks the harm test is satisfied;
5. the investigation, disciplinary and other proceedings and their outcome;
6. any action taken, “including whether or not the matter has been referred to the police or to any other person”.

DBS asks for more than the minimum: “job description, internal and external investigation and disciplinary processes, interviews, chronology of events, victim impact, relevant training, and supervision records, contact details for any other organisations involved, and evidence of previous misconduct.” A handwritten statement should come with “a typed-up version, which is signed and dated”, and any redaction should be limited to “what is necessary”. DBS warns that referral information could be disclosed to the referred individual or other parties, so keep statements factual, dated and attributed.

How to refer. DBS says “Submitting an online barring referral takes around an hour”. The online referral service is open Monday to Sunday, 8am to 11:30pm, and a GOV.UK One Login is needed to save a referral and return to it. A paper referral form can be requested from contactus@dbs.gov.uk. For advice before deciding, the DBS Regional Outreach Team is at dbsregionaloutreach@dbs.gov.uk, and the DBS helpline is 03000 200 190 (option 2, then 1).

DBS can come back for more: under section 37 of the Act it may require a provider that arranged the person's regulated activity, “whether or not the arrangements are still in place”, to provide the prescribed information it holds, and failing to do so is also an offence.

The records behind a referral, and what to keep

A referral is only as good as the file behind it, and under section 37 DBS can later require the prescribed information the organisation holds. The file should hold:

• the first report of the concern, in the words and on the date it arrived, and who received it;
• a dated chronology, built as the investigation goes rather than reconstructed at the end;
• interview notes and statements, signed and dated;
• the decision on whether the section 35 conditions are met, who made it, when and why, including a reasoned decision not to refer;
• the date and reference of the referral, and a copy of everything sent;
• correspondence with DBS, including any section 37 request.

DBS will not always say what it decided. Asked whether it tells the referrer the outcome, DBS answers: “Only if you can prove a legitimate interest in the person you have referred.”

None of these sources sets a retention period for the referral file itself. For schools, KCSIE paragraph 500 says allegation records “should be retained at least until the accused has reached normal pension age or for a period of 10 years from the date of the allegation if that is longer”, and a referral can sensibly sit with the allegation record it arose from. Other organisations should set a period in their retention schedule and record why. Certificate information follows different rules, in the DBS record keeping guide. Keep access to the people handling the case.

The first message is the start of the chronology

DBS asks for a chronology, and the first entry in most chronologies is not a form. It is a parent texting a class teacher on a Sunday that their child came home upset about a member of staff. It is a care worker messaging the registered manager at eleven at night about something a colleague said to a resident. Each is the moment the organisation first knew.

When that message sits on a personal phone, the organisation cannot produce it. The person who received it changes number, or resigns before the investigation ends, and the thread goes with them. The referral then rebuilds the first report from memory, the weakest point in any file. An end-to-end-encrypted consumer app is built so that only the people in the chat hold the messages, which is why it cannot give the organisation a record.

ComplyChat is designed for those conversations. Staff, volunteers and managers talk in a channel the organisation holds; everyone added is told it is on the record and can object or leave; and a mobile number verified by SMS is an identity, which matters because volunteers, bank staff and agency workers often have no work account. Messages are recorded on the server as they are sent, and on paid plans the lasting record files into the organisation's own Microsoft 365 once its tenant is connected, under its own retention rules. ComplyChat does not make, file or track DBS referrals, it is not a case management or HR system, and it does not decide whether the section 35 conditions are met.

A question for the next leadership or board meeting: if we had to build a referral chronology tomorrow, could we produce the first message that raised the concern, even if the person who received it had left?

Questions people ask

Do I still have to refer to the DBS if the person resigned?

Yes. Section 35(2)(b) of the Safeguarding Vulnerable Groups Act 2006 applies where you would or might have withdrawn permission had the person not otherwise left, and DBS gives “a teacher resigns when an allegation of harm to a student is first made” as an example. Complete the investigation even after they have gone.

Is it an offence not to refer to the DBS?

Yes. Under section 38 of the Safeguarding Vulnerable Groups Act 2006, failing to refer without reasonable excuse is an offence punishable by a level 5 fine, which in England and Wales has been unlimited for offences committed since 12 March 2015.

Should I refer to the DBS when I suspend someone?

Usually not at that point. DBS says the duty “may not be triggered by temporary suspension” and that you should investigate and conclude first; its leaflet says that during a suspension pending investigation “the referral may not be necessary” and to seek advice from the DBS Regional Outreach Team. The duty arises if you then dismiss the person or remove them from regulated activity. KCSIE 2026 paragraph 431 lists suspension among examples of removal, so a school that suspends because it already thinks the harm test is met should take advice rather than wait.

Does the duty to refer apply to volunteers?

Yes. KCSIE 2026 paragraph 429 says the duty “applies equally to paid staff and volunteers”, and the Care and support statutory guidance says the same of a “paid worker or unpaid volunteer”.

Will the DBS tell me the outcome of my referral?

Only if you can show a legitimate interest in the person. DBS says that if you no longer employ the referred person or let them engage in regulated activity, you may not be able to show one.

When employing someone in a role that includes regulated activity, which DBS check would be required?

An enhanced DBS check with barred list information for the relevant workforce. KCSIE 2026 paragraph 383 says school and college volunteers who teach, train, instruct or supervise children frequently, on more than 3 days in a 30-day period or overnight are now in regulated activity and schools should obtain an enhanced check with children's barred list information. Paragraph 385 adds that existing volunteers newly in regulated activity from 1 September 2026 must have their children's barred list status checked.

Official guidance and your next step

The primary sources are sections 35 to 38 of the Safeguarding Vulnerable Groups Act 2006, the Prescribed Information Regulations 2008, DBS's Making barring referrals to DBS and The legal duty to refer to DBS, paragraphs 383 to 385, 427 to 431 and 497 to 500 of Keeping children safe in education 2026, paragraphs 3.19 and 3.20 of the two EYFS frameworks, and chapter 14 of the Care and support statutory guidance. Quotations are from those pages as published on 8 October 2026.

This guide summarises the law and guidance in England and Wales, with notes on Northern Ireland and Scotland, and is not legal advice about an individual case. Where it is unclear whether the conditions are met, take advice from the DBS Regional Outreach Team, your LADO or safeguarding team, or a solicitor before deciding not to refer.

Then do one thing: open your safeguarding or disciplinary policy and check that it names who decides whether the duty to refer is met, and says the investigation continues to a conclusion if the person resigns.